Skip to main content

Network analysis

The repeat-seizure loop

Successors that were themselves targeted later, traced as chains with named edges rather than impressions.

Computed from the published tables at the August 23, 2026 research cutoff. Last reviewed August 23, 2026.

Some successors do not last either. 19 successor records in the index are marked as having been acted on again in a later enforcement action, and 16 of them name the specific follow-up record, which turns them into chains you can walk rather than impressions you have to trust.

The denominator, before the number

The seized-again field is populated on 45 of the 61 successor records. The rest carry nothing on the question, which is not the same as carrying a no. So the honest ratio is 19 of 45 where anyone asked, and quoting it against 61 understates the loop by a wide margin.

What a chain looks like

The clearest cases run through the same brand for years. An enforcement action removes a forum, a successor absorbs its users, that successor is itself taken down, and the pattern repeats. Where both ends of an edge exist as records here, the successor row carries a link to the later action, so the sequence is navigable from either end.

Encrypted communications platforms show the same shape for a different reason. Each takedown pushed users onto the next platform, and in more than one case the next platform was already under law enforcement control when they arrived. That is displacement working exactly as the operation intended, and it still produces a chain.

What repeat action proves

It proves the successor existed, was identified, and was worth acting on again. That is a real finding, and it is the strongest available evidence that a class of service reconstitutes rather than disappearing.

It does not prove the first action failed. A successor being seized does not undo the original seizure or the prosecutions that followed it. It also does not prove enforcement is futile, which is the reading these chains most often get put to. What it shows is that the response to durable criminal infrastructure looks like a campaign measured in years rather than a single event, and the index can now show that with named edges instead of assertion.

Reading the ecosystem cases carefully

Successors classed as ecosystem successors are hit again more often than successors classed as the same operators returning. That reads as selection rather than mystery. An ecosystem successor is by definition the platform that absorbed a displaced user base, which makes it large, visible and the obvious next target. A same-operator return is often a smaller reconstitution that stays under the threshold where anyone acts.

Every edge is a cited record. Walk them from the takedowns index, or pull the raw relationships from the data downloads and rebuild the graph yourself. The wider outcome picture is on do takedowns hold?.

Every figure above is derived from the published tables and can be recomputed from them. Download the data, then read the counting rules and the known limitations before citing any of it.